Return to Answer

Revised: The proposed construction is just fine, and in particular:

• at least as secure as SHA-256 against collision attacks, that is the ability for an adversary to construct two files with the same hash;
• likely about as secure as SHA-256 against both first and second preimage attacks, that is the ability for an adversary to construct (for first preimage) a file with some hash given as an arbitrary value, or (for second preimage) the same hash as another file with the same hash as an arbitrary given file.

The construction would slightly reduce the second-preimage resistance of a maximally resistant hash. But for SHA-256, the second-preimage resistance seems to remain no worse than allowed by a generic attack on Merkle-Damgård hashes attributed to R. D. Dean in his 1999 thesis (section 5.3.1), better exposed and refined by J. Kelsey and B. Schneier in Second Preimages on $n$-bit Hash Functions for Much Less than $2^n$ Work.

Revised: The proposed construction is just fine, and in particular:

• at least as secure as SHA-256 against collision attacks, that is the ability for an adversary to construct two files with the same hash;
• likely about as secure as SHA-256 against both first and second preimage attacks, that is the ability for an adversary to construct (for first preimage) a file with some hash given as an arbitrary value, or (for second preimage) a file with the same hash as an arbitrary given file.

The construction would slightly reduce the second-preimage resistance of a maximally resistant hash. But for SHA-256, the second-preimage resistance seems to remain no worse than allowed by a generic attack on Merkle-Damgård hashes attributed to R. D. Dean in his 1999 thesis (section 5.3.1), better exposed and refined by J. Kelsey and B. Schneier in Second Preimages on $n$-bit Hash Functions for Much Less than $2^n$ Work.

To sum up other contributions, the proposed construction:

• is at least as secure as SHA-256 against collision attacks, that is the ability for an adversary to construct two files with the same hash; if SHA-256 was perfect, difficulty would be in the order of $2^{128}$ hashes.

• is slightly less secure than SHA-256 against second-preimage attacks, that is the ability for an adversary to construct a file with the same hash as a given arbitrary file; if SHA-256 was perfect, difficulty would be in the order of $2^{256}/n$ hashes for $n$ separately hashed blocks (e.g. $2^{245}$ hashes for the envisioned $n=32768$), which is perfectly fine for any practical purpose.

Revised: The proposed construction is just fine, and in particular:

• at least as secure as SHA-256 against collision attacks, that is the ability for an adversary to construct two files with the same hash;
• likely about as secure as SHA-256 against both first and second preimage attacks, that is the ability for an adversary to construct (for first preimage) a file with some hash given as an arbitrary value, or (for second preimage) the same hash as another file with the same hash as an arbitrary given file.

The construction would slightly reduce the second-preimage resistance of a maximally resistant hash. But for SHA-256, the second-preimage resistance seems to remain no worse than allowed by a generic attack on Merkle-Damgård hashes attributed to R. D. Dean in his 1999 thesis (section 5.3.1), better exposed and refined by J. Kelsey and B. Schneier in Second Preimages on $n$-bit Hash Functions for Much Less than $2^n$ Work.

To sum up other contributions, the proposed construction:

• is at least as secure as SHA-256 against collision attacks, that is the ability for an adversary to construct two files with the same hash; if SHA-256 was perfect, difficulty would be in the order of 2¹²⁸ hashes.

• is slightly less secure than SHA-256 against second-preimage attacks, that is the ability for an adversary to construct a file with the same hash as a given arbitrary file; if SHA-256 was perfect, difficulty would be in the order of 2²⁴¹ hashes, which is perfectly fine for any practical purpose.

To sum up other contributions, the proposed construction:

• is at least as secure as SHA-256 against collision attacks, that is the ability for an adversary to construct two files with the same hash; if SHA-256 was perfect, difficulty would be in the order of $2^{128}$ hashes.

• is slightly less secure than SHA-256 against second-preimage attacks, that is the ability for an adversary to construct a file with the same hash as a given arbitrary file; if SHA-256 was perfect, difficulty would be in the order of $2^{256}/n$ hashes for $n$ separately hashed blocks (e.g. $2^{245}$ hashes for the envisioned $n=32768$), which is perfectly fine for any practical purpose.